taint tracking idea

• a lot of attacks — user data ends up in bad place

  ---

• one way to diagnose/mitigate — track flow of user data
• one possibility: dynamic taint tracking
• some values ‘tainted’
• using them to compute other values ‘taints’ them, too

taint tracking implementations

• for the programmer:

  • supported as optional langauge feature — Perl, Ruby
  • doesn’t seem to have gotten wide adoption?

• for the malware analyst/user

  • as part of a custom x86 VM (whole system, on machine code)
  • as part of a custom Android system
  • …

taint tracking in Perl (1)

#! perl -T
# -T: enable taint tracking
use warnings; use strict;
$ENV{PATH} = '/usr/bin:/bin';

print "Enter name: ";
my $name = readline(STDIN);
my $dir = $name . "-dir";

system("mkdir $dir");

• ‘‘Insecure dependency in system while running with -T switch at perltaint.pl line 10, <STDIN> line 1.’’

taint tracking in Perl (2)

#! perl -T
# -T: enable taint tracking
use warnings; use strict;
$ENV{PATH} = '/usr/bin:/bin';

print "Enter name: ";
my $name = readline(STDIN);
# keep $name only if its all alphanumeric
# this marks $name as untainted
($name) = $name =~ /^([a-zA-Z0-9]+)$/;
my $dir = $name . "-dir";

system("mkdir $name");

taint tracking for malware analysis

• mark contents of file as tainted, then ID how used

  • find out if/how data of file gets to output
  • track tainted accesses to record ‘path’ of file data use

• figure out where network packet data goes

  • mark input as ‘tainted’
  • identify what functions process packet data
  • see where packet data ends up on disk

• can ‘tag’ each byte of input differently

  • identify which bytes of input jump depends
  • identify which bytes of input malicious command came from

• whole-system probably too high overhead to do in realtime

taint tracking assembly

• taint-tracking often proposed at assembly level
• examples:

  ---

• Panda.RE (2013–??)
  • along with virtual machine record+replay
• Panaroma (Yin and Song, UC Berkeley, CCS ’07)

defeating ASM-based checking

• if a malware author wanted to defeat this taint checking, what ideas seem promising for confusing the analysis?

  • A. timing arithmetic operations to see if the machine is unusually slow
  • B. computing the hash of the malware’s machine code and comparing it to a known value
  • C. changing x = y to
    switch (x) { case 1: y = 1; break; case 2: ...}
  • D. changing x = y to x = z + y; x = x - z;